Take Action — AI Agents in the Dental Practice: A HIPAA Compliance Guide

Vendor Evaluation: Questions to Ask

Before selecting an AI agent vendor for your practice, get written answers to:

Will you sign a BAA? Which exact products, features, and configurations does it cover?

Where is our data processed and stored? Who are your subprocessors?

Is our data used for model training? Can we opt out? Is opt-out default?

What are your data retention and deletion policies? Can we request complete deletion?

What audit logs are available to us? How long are they kept? Can we export them?

What happens in a breach? What is your notification timeline and process?

What security certifications do you hold (SOC 2, HITRUST, ISO 27001)?

How do you address prompt injection and agent-specific security risks?

What are your authentication and access control capabilities? Is MFA supported?

Can we configure data residency restrictions (e.g., US-only processing)?

If a vendor cannot or will not answer these questions in writing, that is your answer.

Implementation Checklist

Before any AI agent touches patient information:

☐ Confirm whether the agent will access PHI — if yes, consumer AI accounts are prohibited

☐ Execute a BAA covering the exact product, features, and configuration

☐ Verify required privacy settings are enabled (zero retention, HIPAA endpoints, etc.)

☐ Map all connected systems and confirm PHI handlers are covered

☐ Apply minimum necessary access — start with zero, add only what is needed

☐ Configure human confirmation for consequential actions

☐ Enable and verify audit logging

☐ Document retention, training-data, and secondary-use policies in writing

☐ Address recording-consent requirements under applicable state law

☐ Assess prompt injection risk proportional to agent authority

☐ Conduct or update your HIPAA security risk analysis

☐ Train staff on the agent's capabilities, limitations, and escalation procedures

☐ Establish an incident response plan specific to AI agent failures

☐ Schedule quarterly access and configuration reviews

Frequently Asked Questions

Can I use ChatGPT to help write patient letters if I remove names?

De-identified data is not PHI under HIPAA, but true de-identification is harder than removing names. Dates, locations, rare conditions, and combinations of details can re-identify patients. If there is any doubt, use a BAA-covered service.

My EHR vendor offers an AI feature. Is it automatically compliant?

No. Confirm that the specific AI feature is covered under your existing BAA or requires an amendment. Ask the vendor directly.

Can an AI scribe replace my hygienist's clinical notes?

An AI scribe can assist with documentation, but the licensed clinician remains responsible for the accuracy and completeness of the clinical record. AI-generated notes require human review before becoming part of the record.

What if a patient asks whether AI was involved in their care?

Transparency is good practice. Patients have a right to understand how their information is used. Consider disclosing AI involvement in your notice of privacy practices.

Does HIPAA apply if I only use the agent for scheduling?

If the agent handles patient names, phone numbers, or appointment details linked to individuals, that is PHI and HIPAA applies. Truly anonymized availability (open slots with no patient linkage) is not PHI.

Prefer to read offline?
📄 Download PDF All White Papers